HIGH 8.6 NVD
CVE-2026-109440
LangAlpha through 2026.09.07 contains an indirect prompt injection vulnerability that allows remote attackers to execute shell commands or Python by planting in
LangAlpha through 2026.09.07 contains an indirect prompt injection vulnerability that allows remote attackers to execute shell commands or Python by planting instructions in web content retrieved by the agent. Because Bash and ExecuteCode lack an allow-list and human-in-the-loop approval, attackers can run code in the workspace sandbox and exfiltrate vault secrets from _internal/.vault_secrets.json.
References
- https://github.com/ginlix-ai/LangAlpha/blob/435a5a44fabdeb33e409a62d233a936d96241c86/src/p
- https://www.lasso.security/vulnerability-database/cve-2026-109440
- https://www.vulncheck.com/advisories/langalpha-through-2026.09.07-indirect-prompt-injectio
This high severity vulnerability with a CVSS score of 8.6 was published on 2026-10-20 via NVD.
vulnfeed aggregates 17400 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.